By OTS July 2, 2025
The JMD 1689/2025 introduces some important obligations for Greek businesses and public entities in the cyber security field, by setting a new national frame for the protection of the digital infrastructures.
The outline
The new frame, that is relying on the 5160/2024 law, addresses some “basic” and “important” entities and includes technical, organisational and administrative actions for the managing of cyber threats. The “basic” entities are included in strictrer demands but every single one is obliged to comply.
Focal points of the JMD
Obligatory framing of a complete cyber security programme, under the higher administration’s supervision.
Clear involvement of the administration, which is called to approve, monitor and ensure the materialization of the programme.
Establishment of security policies, with general and specific thematic parts (such as access, encryption, physical security)
Appointment of Security Manager, with a direct reporting to the supreme body of administration- a role clearly distinct from that of DPO.
Inclusion of Cyber Security in the general strategy of danger- handling of every entity.
Periodic estimation of dangers and compliance evaluation with corrective actions, where needed.
Recording and indexing of software goods based on the criticality and the security needs.
Challenges and next step:
The enforcement of the JMD requires:
Procedures re-evaluation
Development of a compliance plan
Personnel training
Invensting in security technologies
The JMD 1689/2025 marks a turn in the cybersecurity field, from technical obligation to an administration’s strategic responsibility. Its successful application is a challenge, but also an opportunity for an upgrade of the security level in the public and private sector.